Dr. rer. nat. Hellmuth Broda

Transcription

1 International Telecommunication Union Privacy, Security, and Trust with Federated Identity Management Dr. rer. nat. Hellmuth Broda Distinguished Director and CTO, Global Government Strategy, Sun Microsystems Inc. Spokesperson, Liberty Alliance; Member of the Business Marketing Expert Group Member, Swiss Academy of Engineering Sciences; VP, Scientific Advisory Board

2 Life With An Identity Mess A typical intensive IT user has 21 passwords 49% write their passwords down or store in a file on their PC Majority use common words for passwords; 67% rarely or never change their passwords * Source: NTA Monitor Password Survey, UK; zdnet.com Password proliferation increases Help Desk Calls In a non-automated support model, password reset costs range from $51 to $147 for the labor alone (Gartner) In an average 10,000 employee size company, about 45% of helpdesk calls are requests for password resets. (Meta Group) Identity Silos (Source: Sun Customer Survey) Typical IT: 10 different apps or services that contain identity profiles Over 80% of companies have no Identity synchronization solution

3 How Did Computing Live Without Identity? Location was an implicit proxy for Identity

4 Enter Liberty Liberty Alliance provides the means to build the Common Framework for Federated Identity Management Technology Policy Knowledge Certifications Over 150 diverse member companies and organizations from around the world: Government organizations End-user companies System integrators Software and hardware vendors Huge adoption: Close to a billion identities already under Liberty standards

5 Who Is the Liberty Alliance? o Consortium developing open standards For federated identity management In coordination with other standards groups o Develops open specifications that anyone can implement Liberty does not deliver specific products or services o Conformance testing & certification to ensure interoperability 30+ Liberty-enabled products and services currently available o Addresses business & policy issues of identity Guidelines, best practices documents, checklists Support for global privacy regulations built into specs

6 o o Who is the Liberty Alliance? Global collection of diverse member organizations representing leaders in IT, mobility, government, manufacturing, finance and consumer services. About 145 members total Management Board and Sponsor members include:

7 The biggest concern of the principal/patient/customer is privacy Privacy does not mean that nobody knows nothing about me* It is about managing the faith of the principal/patient/customer by adhering to the agreed scope and holding the information in trust Customers are afraid of Purpose Creep What could an architecture for privacy and trust management look like? *The Sopranos How We Can Build Trust

8 Architecture for Trust Management Identity Management Policy Authorization A combination of business and technology practices which define how a relationship is conducted and services are performed A set of rules governing decisions about what the user can do: access to information, services or resources Security Management Authentication Identity Assertion of validity of a set of credentials. Credentials express a person s identity. A Yes/No answer Basic set of information that creates a unique entity (a name with a corresponding set of attributes)

9 Identity Management Security Management Architecture for Trust Management Real World Example: Policy Authorization Authentication Identity 4. The fact that we do have police; the rules that allow me to drive with my national license in other countries 3. The policeman will then see which kind of vehicle you are authorized to drive and if you are allowed to drive the one you are operating now 2. Assertion of validity: The policeman compares the document with you. Result: A Yes/No answer 1. Name, address, picture identify the driver and provide together with the document the credentials expressing that the carrier is identical to the person that passed the driving tests Drivers License

10 Identity Management Architecture for Trust Management Policy Authorization Digitally Speaking Business practices to manage risk, enforce security/privacy, provide auditability. User, customer preferences, history, personalized services, 3. Determination of access rights to systems, applications and information: Match credentials against profiles, ACLs, policy Security Management Authentication Identity 2. Log on with a UID/PW, token, certificate, biometrics etc. A process that demands the prove that the person presenting them is indeed the person to which credentials were originally issued. accept or reject 1. User, customer, device facts, e.g., name, address, ID, DNA, keys; credentials, certificates that were issued e. g. by a Certification authority

11 Policy and its audit have to be guaranteed and certified by a approved public or private independent organization, e. g.: How People Will Trust Policies Federal or state data protection agency TÜV (private institution) Audit firm Chamber of Commerce Postal Service or other basic service provider,... This can be achieved with defined processes and responsibilities similar to ISO 9000 Trust is based on policies and the audit of those -- not just on security

12 Where to Safeguard User's Information ITU-T Credit History Health History Travel History Single Identity Operator Insurance Records Meal Preferences Health History Loyalty Program Insurance Health & Travel Records Insurance Travel Agent Travel Histor y Retail Bank Airline Credit History Hotel Chain Car Rental Meal Preferences Meal Preferences Car Type Preferences

13 Liberty Promotes Privacy and Security o Federated structure means no single centralized data storage that would be vulnerable to attack o End user has more control of data because permissions travel with data, guiding its use o No global identifier--model protects against unauthorized data sharing

14 Circle of Trust organizations and individuals (example healthcare) Business relationships based on Liberty architecture & operational agreements Enables patients, physicians and healthcare organizations to safely share information in a secure and apparently seamless environment Without violating privacy How it Happens Principal e.g. Patient Service Provider e.g. Hospital Identity Identity Provider Provider Authentication Authentication Federation Federation Discovery Service Discovery Service Personal Profile Personal Profile Principal Principal Principal e.g. e.g. Physician e.g. Physician Physician Circle of Trust Service Provider e.g. Physician Identity-Based Web Service Provider e.g. eprescriptions.com Service Provider e.g. Pharmacy

15 The Liberty Advantage ITU-T o Wide-spread adoption 1 billion identities under Liberty protocols Multiple vendor competition Freedom of choice o Convergence with other standards e.g., SAML2.0, Shibboleth o Federated authentication model No central point of failure o Built on standards Works with existing legacy systems and future development plans o Privacy & security best practices Create trust for all participants o Conformance testing & certification Provides for multi-product interoperability

16 More On Liberty:

17 Liberty Adoption o T-Com Netzausweis (1 st prize IDDY award) o American Express o General Motors & Fidelity Investment Portal B2E o Vodafone Vodafone live! o France Telecom Mobile phone convergence o Radio@AOL o ADAE Citizen portal o Sun & BIPAC, Sun & ext. HR Services outsourcing More than one billion Liberty-enabled identities and devices by the end of 2006 and that s just what we know about

18 Examples of Identity Projects Biometrics for Secure Authentication The Future of Identity in the Information Society Government User IDentity for Europe November 24, 2006

19 Summary o In most projects technology was rarely the issue o Legal and business agreements are the hard parts o It is mandatory to use an open standards based approach o Shop for Liberty interoperable products and solutions o Liberty specifications are free and there to be used o Become a member to contribute to the Liberty work

20 Recommendation and Conclusion National and international interoperability with trust and privacy is key Build on existing standards Embrace Federated Identity for role based access and to protect customer's information Federated Identity scales much better than hierarchical approaches. Truly enhances business agility Join the Alliance at http//: